Question

我必须在linux命令行中解析并过滤一些日志文件。在应用了一些awk和sed命令之后

awk -v RS='+++ ' '!/Diameter|REPT OM BLOCKED|REPT OM STARTING/ { print f $0 } {f=RT}' ./snmplog* | grep -v '+++' | grep -v '++-' | sed -e 's/^\s*//g' | sed -e '/^$/d'

我得到了一个类似于xml文件的输出：

<Alarm>
<AlarmIndex>8865</AlarmIndex>
<ObjectName>0-0-1#RcvTCAPabortRatio^0-0-3</ObjectName>
<SpecificProblem>KPI OUTSIDE OF CRITICAL THRESHOLD</SpecificProblem>
<ProbableCause>ThresholdCrossed</ProbableCause>
<NotificationIdentifier>8865</NotificationIdentifier>
<Severity>Cleared</Severity>
<AlarmType>QualityOfServiceAlarm</AlarmType>
<AdditionalText></AdditionalText>
<OMText>REPT MEAS KPI
(RcvTCAPabortRatio^0-0-3 = 20) OUTSIDE OF CRITICAL ALARM THRESHOLD (10)</O
MText>
<AlarmCode>922044</AlarmCode>
<AlarmSource>PLATFORM</AlarmSource>
<AlarmTime>Wed Mar 11 00:15:10 2015</AlarmTime>
<RepeatCount>0</RepeatCount>
<OMDBKey>/MS044</OMDBKey>
<AutoClear>1</AutoClear>
</Alarm>

<Alarm>
<AlarmIndex>8928</AlarmIndex>
<ObjectName>0-0-1#RcvTCAPabortRatio^0-0-11</ObjectName>
<SpecificProblem>KPI OUTSIDE OF CRITICAL THRESHOLD</SpecificProblem>
<ProbableCause>ThresholdCrossed</ProbableCause>
<NotificationIdentifier>8928</NotificationIdentifier>
<Severity>Cleared</Severity>
<AlarmType>QualityOfServiceAlarm</AlarmType>
<AdditionalText></AdditionalText>
<OMText>REPT MEAS KPI
(RcvTCAPabortRatio^0-0-11 = 19) OUTSIDE OF CRITICAL ALARM THRESHOLD (10)</
OMText>
<AlarmCode>922044</AlarmCode>
<AlarmSource>PLATFORM</AlarmSource>
<AlarmTime>Wed Mar 11 00:15:10 2015</AlarmTime>
<RepeatCount>0</RepeatCount>
<OMDBKey>/MS044</OMDBKey>
<AutoClear>1</AutoClear>
</Alarm>

<Alarm>
<AlarmIndex>8771</AlarmIndex>
<ObjectName>0-0-1#SuccStandaloneISDRatio</ObjectName>
<SpecificProblem>ZERO DENOMINATOR</SpecificProblem>
<ProbableCause>CorruptData</ProbableCause>
<NotificationIdentifier>8771</NotificationIdentifier>
<Severity>Cleared</Severity>
<AlarmType>ProcessingErrorAlarm</AlarmType>
<AdditionalText></AdditionalText>
<OMText>REPT MEAS KPI
CALCULATION OF (SuccStandaloneISDRatio) FAILED FOR ZERO DENOMINATOR</OMText>
<AlarmCode>922041</AlarmCode>
<AlarmSource>PLATFORM</AlarmSource>
<AlarmTime>Wed Mar 11 01:00:10 2015</AlarmTime>
<RepeatCount>0</RepeatCount>
<OMDBKey>/MS041</OMDBKey>
<AutoClear>1</AutoClear>
</Alarm>

我想在威胁之后有这样的事情：

<Alarm><AlarmIndex>8771</AlarmIndex>...<OMText>REPT MEAS KPI
CALCULATION OF (SuccStandaloneISDRatio) FAILED FOR ZERO DENOMINATOR</OMText><AlarmCode>922041</AlarmCode>...</Alarm>

我必须删除>之后的所有新行，并在标记之间保留新行。正如您在我的日志中看到的那样，我在标记</OMText>中遇到了一个问题，我也可以在其中添加一个新行，并且应将其删除。

我已尝试使用此处找到的许多sed正则表达式，但没有成功

我该怎么做？

[编辑]

根据要求，请在原始日志文件下面找到：

   +++ FE01 2015-03-11 00:25:35 SNMP /SNM001 #310852 0-0-1 >
   <Alarm>                           
    <AlarmIndex>1119</AlarmIndex>                     
    <ObjectName>0-0-3#destMMENotAvail</ObjectName>    
    <SpecificProblem>CLR error,Diameter Peer:p3.mmeccd.3gppnetwork.org</SpecificProblem>               
    <ProbableCause>CommunicationsSubsystemFailure</ProbableCause>
    <NotificationIdentifier>1119</NotificationIdentifier>
    <Severity>Minor</Severity>                        
    <AlarmType>CommunicationAlarm</AlarmType>         
    <AdditionalText>The destination MME is not reachable</AdditionalText>
    <OMText>CLR error,Diameter Peer:p3.mmeccd.3gppne
   twork.org</OMText>                           
    <AlarmCode>50906</AlarmCode>                      
    <AlarmSource>SDM#RTLTE</AlarmSource>              
    <AlarmTime>Wed Mar 11 00:25:35 2015</AlarmTime>   
    <RepeatCount>0</RepeatCount>                      
    <OMDBKey></OMDBKey>                           
    <AutoClear>1</AutoClear>                          
   </Alarm>                           

   END OF REPORT #310852++-                           

   +++ FE01 2015-03-11 00:25:58 SNMP /SNM001 #310853 0-0-1 >
   <Alarm>                           
    <AlarmIndex>8914</AlarmIndex>                     
    <ObjectName>0-0-14#2AILogger.C!81</ObjectName>    
    <SpecificProblem>OM BLOCKED AILogger.C</SpecificProblem>
    <ProbableCause>QueueSizeExceeded</ProbableCause>  
    <NotificationIdentifier>8914</NotificationIdentifier>
    <Severity>Minor</Severity>                        
    <AlarmType>QualityOfServiceAlarm</AlarmType>      
    <AdditionalText></AdditionalText>                 
    <OMText>REPT OM BLOCKED FOR PROCESS PDLSU1        
      612 MESSAGES DISCARD                           
      OM IDENTITY :                            

      CRERROR BEING BLOCKED; FILE : AILogger.C LINE NUMBER : 81
      </OMText>                           
    <AlarmCode>906065</AlarmCode>                     
    <AlarmSource>PLATFORM</AlarmSource>               
    <AlarmTime>Wed Mar 11 00:25:58 2015</AlarmTime>   
    <RepeatCount>0</RepeatCount>                      
    <OMDBKey>/CR065</OMDBKey>                         
    <AutoClear>1</AutoClear>                          
   </Alarm>                           

   END OF REPORT #310853++-

首先，我必须删除包含在标签内的消息：＆＃34; Diameter＆＃34;，＆＃34; REPT OM BLOCKED＆＃34; ＆＃34; REPT OM STARTING＆＃34;然后只在标签之间保留消息......

Answer 1

要管道（应该像以后发布的原始文件一样进行修改）

sed '
# don t care out of section
/<Alarm>/,\#</Alarm># !d
# in section
/<Alarm>/,\#</Alarm># {
#  keep line in hold buffer
   H
#  if not the end, loop (cycle to next line and start of script)
   \#</Alarm># !b
#  clean current buffer
   s/.*//
#  exchange buffer (current/hold)
   x
#  remove first new line (extra due to first keep)
   s/\n//

#  remove first new line
   s/\n//
#  reformat first part until OMText
   s#\(</AlarmIndex>\).*\(<OMText>\)#\1...\2#
#  reformat between AlarmCode and /Alarm
   s#\(</AlarmCode>\).*\(</Alarm>\)#\1...\2#
# print result at output
   }' YourFile

自我解释，posix版

Answer 2

awk '
  /<Alarm>/,/<\/Alarm>/ {
    sub(/^[[:blank:]]+/, "")     # trim leading blanks
    sub(/[[:blank:]]+$/, "")     # trim trailing blanks
    if (/>$/)                    # if the line ends with a tag
      printf "%s", $0            # print it with no newline
    else
      print
  }
  /<\/Alarm>/ {print ""}         # add a newline after each Alarm block
' log.file

输出

<Alarm><AlarmIndex>1119</AlarmIndex><ObjectName>0-0-3#destMMENotAvail</ObjectName><SpecificProblem>CLR error,Diameter Peer:p3.mmeccd.3gppnetwork.org</SpecificProblem><ProbableCause>CommunicationsSubsystemFailure</ProbableCause><NotificationIdentifier>1119</NotificationIdentifier><Severity>Minor</Severity><AlarmType>CommunicationAlarm</AlarmType><AdditionalText>The destination MME is not reachable</AdditionalText><OMText>CLR error,Diameter Peer:p3.mmeccd.3gppne
twork.org</OMText><AlarmCode>50906</AlarmCode><AlarmSource>SDM#RTLTE</AlarmSource><AlarmTime>Wed Mar 11 00:25:35 2015</AlarmTime><RepeatCount>0</RepeatCount><OMDBKey></OMDBKey><AutoClear>1</AutoClear></Alarm>
<Alarm><AlarmIndex>8914</AlarmIndex><ObjectName>0-0-14#2AILogger.C!81</ObjectName><SpecificProblem>OM BLOCKED AILogger.C</SpecificProblem><ProbableCause>QueueSizeExceeded</ProbableCause><NotificationIdentifier>8914</NotificationIdentifier><Severity>Minor</Severity><AlarmType>QualityOfServiceAlarm</AlarmType><AdditionalText></AdditionalText><OMText>REPT OM BLOCKED FOR PROCESS PDLSU1
612 MESSAGES DISCARD
OM IDENTITY :

CRERROR BEING BLOCKED; FILE : AILogger.C LINE NUMBER : 81
</OMText><AlarmCode>906065</AlarmCode><AlarmSource>PLATFORM</AlarmSource><AlarmTime>Wed Mar 11 00:25:58 2015</AlarmTime><RepeatCount>0</RepeatCount><OMDBKey>/CR065</OMDBKey><AutoClear>1</AutoClear></Alarm>

在2个模式之间删除模式和换行符后的新行

2 个答案: